Extracted

• • Target

    a104b850a27f199bc9f838408d09c5523292eaf7271cc44b159ed27472ea5481

  • Size

    4.5MB

  • MD5

    bd2996dba83f791d96a30f366d244a80

  • SHA1

    7e21fbc6064acc21449a6a636efdd6ab5aaeccc8

  • SHA256

    a104b850a27f199bc9f838408d09c5523292eaf7271cc44b159ed27472ea5481

  • SHA512

    a9cc65ffb687e551f8c19604161104dc07b9ccfb73f75f4f41990c88d7cd2a187e19f84a379dfeacd0d17ee59c4f420f13a42c218aadd9acd26e9d62805ec3a5

  • SSDEEP

    98304:mIAK4IOsNXbqUjeq7GGT1/unJyoE5RjHRpkTD9eFM5YrVwJ4sd7iBE+:VZxOsNbqbq91mJyoE7UQMGy/+

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2